Enhancing Cloud Data Security Through Functional-Based Stream Cipher and Attribute-Based Access Control with Multiparty Authorization

In the modern era, the cloud has become the potential destination for data storage. At the same time, handling data has become challenging for any large organization. Opting for remote storage services gives individuals access to nearly limitless storage space, which can result in substantial savings on data storage and management expenses [1]. The convenience of uploading and retrieving files from any location via the internet is a significant advantage of cloud storage. This flexibility has driven more users to deploy their applications on cloud-based servers. In a typical cloud storage setup, the responsibility for safeguarding data lies with the cloud servers. However, these servers are sometimes managed by cloud service providers who may not be fully trustworthy, posing a potential risk of private data being accessed by unauthorized entities. To mitigate this vulnerability, it is common practice for users to encrypt their files before uploading them to the cloud. This encryption helps ensure the security of their data, providing an additional layer of protection against unauthorized access. Data owners often outsource their massive chunks of data to cloud servers using pre-designed Access Control Policies (ACP) [2]. In a cloud environment, data owners have limited control over their stored data. To address issues related to authorization, confidentiality, and integrity, both ACPs and cryptographic algorithms are utilized. ACPs and cryptographic algorithms provide a robust framework for protecting sensitive information in cloud storage environments. The traditional cryptosystem uses complex key management such as (Random Number Generation (RNG), Key Derivation Functions (KDF), Key Exchange Protocols, Key Wrapping, and Key Pair Generation) with high storage overhead [3]. Researchers have utilized Attribute-Based Encryption (ABE) in response to encryption challenges. ABE empowers them to tackle encryption issues by enabling access control based on predefined attributes or characteristics, thus enhancing the flexibility and granularity of data protection. The ABE is the public-key cryptosystem technique that uses access control and authorization policy for data sharing. Sahai and Waters [4] explored the intricate interplay between users and stored data, shedding light on their relationship dynamics. The encryption scheme was formulated as a representation of the identity (I) and its ability or inability (θ) to operate on a Resource (R) within the ecosystem, encompassing all possible combinations of ‘I’, ‘θ’, and ‘R’ [5]. ABE has several disadvantages, such as substantial computation costs, encryption/decryption time, and key management [6]. The fined-grained Access Control List (ACL) is used to overcome the mentioned problem. In today’s scenario, few systems have been implemented based on ACL and ABE in cloud environments [7]. However, using ABE provides flexibility but increases overhead during multi-linear mapping and public key transmission [8]. This study aims to minimize encrypted data access and solely provide the decryption key to authorized individuals. The system is designed based on three factors: (i) Key Management, (ii) Authorization Policy, and (iii) Privacy Prevention. The key management works on the Access Control List (ACL), which uses the functional-based Stream cipher for data encryption/decryption and improved RSA uses for secure key sharing. The authorization policy uses simple scalar points over a parabolic curve for key generation. The access control policy will be updated at every ∆T sec to verify additional attributes, which helps protect confidential data leakage [9].

1.1 Main idea

The proposed system integrates an authorization and access control scheme to enhance the security of data storage and sharing. Using a Functional-Based Stream Cipher (FBSC), data is encrypted and stored on an organization’s server. The distribution of the symmetric secret key relies on data owner attributes to construct the polynomial. Shamir’s Secret Sharing divides the symmetric secret key into ‘n’ shares. Asymmetric encryption is used to exchange these secret shares among multiple privileged data users to maintain the confidentiality and integrity of the secret. Secret key points are reconstructed using Lagrange interpolation, ensuring that users can only access and decrypt data if they possess the necessary access privileges. The system employs a threshold value (k=3), where the Organization server share, Data Owner share, and Data User share are used to reconstruct the symmetric secret key, each bound to a polynomial. For example, a healthcare organization adopts the proposed system to store and share sensitive patient records among its staff securely. Using a Functional-Based Stream Cipher (FBSC), the organization encrypts patient data before storing it on the server. The symmetric secret key for encryption is divided into ‘n’ shares using Shamir’s Secret Sharing based on attributes such as staff roles and departments. Asymmetric encryption ensures secure exchange of these shares among senior doctors, department heads, and IT administrators. To access the encrypted records, the system employs a threshold value (k=3), requiring the shares from the organization server, a data owner (doctor), and a privileged data user (nurse) to reconstruct the key using Lagrange interpolation. This process guarantees that only authorized users with the necessary access privileges can decrypt and access the patient records, maintaining data security and confidentiality.

1.2 Main contributions

Implementation of an authorization and access control scheme combined with a Functional-Based Stream Cipher (FBSC) to ensure secure data storage and sharing.

Use a Functional-Based Stream Cipher (FBSC) to encrypt data before storing it on the organization’s server.

Creation of secret key shares from symmetric secret key using Shamir’s Secret Sharing scheme.

Utilization of asymmetric encryption to exchange secret key shares among privileged users.

Application of Lagrange interpolation to reconstruct the symmetric secret key.

Only users with the appropriate access privileges can access and decrypt the data.

1.3 Organization of this paper

The paper is organized as follows: Section 2 reviews access control schemes for cloud data storage and permission revocation of privileged users. Section 3 introduces the mathematical foundation, including bilinear map and language interpolation. Section 4 presents the proposed system model for functional-based encryption, Secure key sharing, privileged uses, Access control list, and Data user authorization. Section 5 presents the performance and security analysis. Finally, we summarize the entire work and future scope in Section 6.

This section presents the mathematical understanding of bilinear maps and Lagrange interpolation, and Table 1 presents the various symbols used in this paper.

Table 1. Notations

3.1 Bilinear map

A bilinear map e: G×G→G_T with specific properties used for constructing the cryptographic protocols. The components and properties are as follows: Let GP={e, G, G_T, g, p} define the group parameters. Here, G and G_T are multiplicative cyclic groups with the same prime order ‘p’, g=a generator of the group G, e=the bilinear map, and p=prime order of the groups. The properties of bilinear map ‘e’ are:

(1) Bilinearity: For all a, b∈Z_p and g₁, g₂∈G. we have e(g₁^a, g₂^b) = e(g₁, g₂)^ab. It means that the bilinear map is linear in both arguments. Specifically, if you scale the input by some scalars a and b, the output is scaled by the product ab.

(2) Non-degeneracy: For all (g₁, g₂)∈G, e(g₁, g₂)≠1 (the identity element of G_T). This property ensures that the bilinear map does not map every pair of elements to the identity element, meaning some pair (g₁, g₂) exist such that e(g₁, g₂) is not the identity in G_T.

(3) Computability: For all (g₁, g₂)∈G, e(g₁, g₂) can be computed in polynomial time. This means that there is an efficient algorithm for computing the bilinear map ‘e’ for any pair of elements from G.

3.2 Lagrange interpolation

Lagrange interpolation is a method to find a polynomial that passes through a given set of points. Given a set of points {(a₀, b₀), (a₁, b₁), …, (a_n, b_n)} where (a_i ≠ a_j) for (i ≠ j), and (i, j) ∈{0, 1, …, n} the Lagrange interpolation polynomial Q_n(x) is given by:

Q_n(x)=$\underset{i=0}{\overset{n}{\mathop \sum }}\,{{\Delta }_{i}}\left( x \right){{b}_{i}}$            (1)

where, Δ_i(x) is the Lagrange basis polynomial, defined as:

${{\Delta }_{i}}\left( x \right)=\underset{i=0}{\overset{n}{\mathop \sum }}\,\left( \underset{\begin{matrix}   j=0  \\   j\ne i  \\ \end{matrix}}{\overset{n}{\mathop \prod }}\,\frac{x-{{a}_{j}}}{{{a}_{i}}-{{a}_{j}}} \right)\times {{b}_{i}}$                          (2)

where, a_i=x-coordinates of the given points, b_i=y-coordinates (function values) of the given points and Δ_i(x) is the Lagrange basis polynomial associated with the i^th point in the set of ∈{0, 1, …, n}. If there are (n+1) points, a unique polynomial of degree ‘n’ passes through all these points. Lagrange interpolation provides a direct way to construct this polynomial. The Lagrange interpolation formula gives an explicit polynomial for the given points, making it easy to understand and compute. Unlike other interpolation methods like Newton interpolation, Lagrange interpolation does not require solving a system of linear equations. It can simplify the computation and reduce potential numerical issues. Lagrange interpolation can be applied to any set of distinct points. It does not impose any constraints on the distribution of the points.

The section is divided into three sub-sections. Performance Analysis assesses the encryption/decryption process and overall system performance. Throughput measures the rate at which encrypted messages are successfully transmitted to the Organization_Server. Improving the throughput will enhance the overall performance during the encryption process. Statistical Analysis is conducted on an encrypted image to assess the uniformity and deviation between the image pixels. The tests have confirmed that the encrypted data is cryptographically secure and suitable for sharing and storage purposes. Security Analysis focuses on the Attribute-Based Access Control Scheme. The test is divided into two subsections: (i) computational overhead for authorization key generation for every user required to access and share files properly, and (ii) Security analysis is performed where an Adversary (A) performs two types of attacks: chosen plaintext attack and Collusion attack. The subsequent section evaluates the performance of the proposed method and compares it to similar work.

5.1 Performance analysis

The proposed model is simulated on the Linux Mint platform, equipped with a 64-bit processor, 4GB of RAM, an Intel Core i5, and a single-core processor running at a CPU frequency of 1.70GHz. The organizational server setup utilizes the Apache server, allowing the data owner to upload and retrieve data, manage the access control list (including updates, deletions, and modifications), and generate random bits for encryption.

5.1.1 Rand generation phase (RGPhase)

This RG_Phase uses a KM-Generator to generate cryptographically secure random bits [27]. Figure 2 represents the random bit generation, which is uniformly distributed throughout the region.

image004.png

(a) Pictorial representation of random variable

tu_pian_2.png

(b) Pictorial pixel representation

Figure 2. Generation of pseudorandom random bit

Figure 2(a) illustrates the binary output frame of (256×256) with randomness properties. Figure 2(b) shows the histogram plot of the generated sequence in (256×256) window frames. The pixel plot visualizes the uniform distribution of 0’s and 1’s and has no pattern in generation.

5.1.2 Evaluation of encryption/decryption

We examined the encryption time of image files (.tiff) using XOR and Functional-Based Stream Cipher. The image is downloaded from the website (https://links.uwaterloo.ca/Repository.html, accessed on 23-4-2024). The test was conducted on nine different images (tiff) (Lena, Barb, Boat, Goldhill, Mandrill, Mountain, Washsat, Peppers, and Cameraman). A random bit is generated and stored in the matrix ‘A’. The random sequence matches the original image’s matrix ‘B’ (256×256). The XOR is performed between matrix (A $\oplus$ B), and then the Functional-Based Stream Cipher is used for bit-level encryption. Table 2 represents the encryption and decryption of the cameraman image, and histogram analysis represents the uniformity of pixels. The proposed XOR and Functional-Based Stream Cipher (FBSC) performance was assessed by comparing the encryption times for cameraman images with those of traditional encryption algorithms. The results of this comparison can be found in Table 3.

Table 2. XOR and functional-based stream cipher encryption and decryption

Original Image	XOR Image	Decrypted Image
image007.png	image005.png	image007.png
image008.png	image009.png	image010.png

Table 3. Encryption time comparison

Image	Technique	Time (Unit: Second)
Cameraman (256×256)	Sinha et al. [27]	0.006542
	Sun and Lv [28]	0.005362
	Arab et al. [29]	0.025781
	Proposed XOR and FBSC	0.001542

The concept of throughput is utilized to evaluate the efficiency of an algorithm during data transmission. Eq. (30) provides a guide to compute throughput; a higher value indicates superior performance.

$\text{Throughput}=\frac{\text{Plaintext}}{\text{Encryption}~\text{Time}}$                 (30)

In Table 4, a comparison of throughput reveals that the proposed XOR and FBSC techniques outperform other methods. It suggests that the new technique has a lower transfer rate and is suitable for integrating with Organization_Server.

Table 4. Comparison of throughput

Algorithm	Throughput (kb/sec)
Sinha et al. [27]	183.34
Sun and Lv [28]	180.4
Arab et al. [29]	181.89
Proposed XOR and FBSC	184.67

5.2 Statistical analysis

Statistical Analysis is used to evaluate the uniformity of encrypted images.

Figure 3 represents the encryption and decryption process of the cameraman’s image with a different set of keys. Figure 3(a) presents the original image. Figure 3(b) illustrates the encrypted image using the symmetric secret key ‘K1’. Figure 3(c) represents the decrypted image using the symmetric secret key ‘K1’. Now, the sensitivity of FBSC is evaluated by slightly changing the decryption key ‘K2’, presented in Figure 3(d). The re-encryption process with ‘K2’ is presented in Figure 3(e). The difference between the two different encryptions with ‘K1’ and ‘K2’ is present in Figure 3(f). It is observed that the proposed Function-Based Stream Cipher is extremely sensitive to the initial parameter for key generation and doesn’t reveal any sensitive information. We execute the same operation with eight benchmark images (Lena, Barb, Boat, Goldhill, Mandrill, Mountain, Washsat, and Peppers), each with a resolution of (256×256) pixels.

ping_mu_jie_tu_2025-04-29_172655.png

Figure 3. Image encryption using functional-based stream cipher

5.2.1 NIST (SP) 800-22 test

We evaluate the randomness of encrypted images using the NIST Special Publication (SP) 800-22 statistical test suite [30]. We transform encrypted image data into binary sequences and then administer a series of tests to confirm that the encryption process generates outputs practically indistinguishable from random sequences. The evaluation is essential for validating the efficacy and security of cryptographic algorithms employed in image encryption. The input parameter for the test is (i) 128 bits of block length for the block frequency test, (ii) 9 bits for the non-overlapping and overlapping test, (iii) 500 bits for Linear Complexity test, (iv) 16 bits of block length for Sequential test, and (v) 10 bits length for approximation of entropy test. The NIST SP 800-22 test suite offers a comprehensive set of statistical tests to evaluate the randomness of binary sequences, crucial for ensuring the security of cryptographic algorithms. The Frequency Test estimates the ratio of 0s to 1s in the generated stream, with significant deviations from a 50/50 ratio indicating non-randomness. The Block Frequency Test checks the number of 1s in fixed-size blocks, while the Cumulative Sum (Cusum) Test determines whether the sequence stays positive or negative for extended periods, signaling potential non-random behavior.

The Runs Test assesses the oscillation rate of 0s and 1s, ensuring the frequency of runs of consecutive 0s and 1s falls within expected limits. The Longest Run of 1s in a Block Test evaluates the length of the longest run of 1s in each block, comparing it to expected values to gauge randomness. The Rank Test checks for linear dependencies among fixed-length substrings by examining the ranks of matrices derived from the sequence.

The Discrete Fourier Transform (Spectral) Test applies FFT to the sequence to detect repetitive patterns, while the Non-Overlapping Template Matching Test identifies occurrences of predefined non-periodic patterns. The Overlapping Template Matching Test looks for overlapping patterns, and the Universal Statistical Test examines the distribution of bits between matching patterns.

The Approximate Entropy Test compares the frequency of overlapping blocks of two consecutive lengths, and the Random Excursion Test evaluates the number of cycles returning to zero for different lengths. The Random Excursion Variant Test extends this by examining cycles at every state. The Linear Complexity Test measures the complexity of the sequence by counting the number of distinct linear feedback shift registers (LFSRs) needed to reproduce it.

Finally, the Serial Test comprises two parts: the Serial 1 Test, which examines the frequency of all possible length m patterns, and the Serial 2 Test, which detects overlapping patterns of length 2m. Together, these tests ensure that a sequence demonstrates the properties of true randomness, which is vital for cryptographic security.

The statistical hypothesis for the testing of encrypted images works on two possible outcomes; H₀=accept the uniformity of encrypted image pixels and H₁=reject the null hypothesis. The fixed significance level (α>0.01) defines the randomness of encrypted image pixels. Two error types, Type I and Type II, consider the encrypted image’s randomness. If the pixels are random, the null hypothesis is rejected, concluding that it is non-random (Type I error). If the stream non-random accepts the null hypothesis, it determines that it is random (Type II error). Table 5 presents the hypothesis of accepting the uniformity of pixels in an encrypted image.

Table 5. Hypothesis testing scenario

Situation	Scenario 1	Scenario 2
Uniformity in encrypted image pixel (H0)	H0 is accepted No error	H0 is rejected (Accept H1) Type I error
Non-uniformity in encrypted image pixels (H1)	Type II error	No error

The NIST test applies to nine benchmark encrypted images, and the p-value of each test is present in Table 6. The result of p-value indicates that all the pixels of encrypted images are uniformly distributed. When the p-value is less than 0.001 under the NIST SP 800-22 standard, it suggests the absence of a random pattern in the sequence of bits. Conversely, a p-value of 0.001 or higher indicates that the tested bits demonstrate a uniform distribution and possess statistical reliability.

Table 6. NIST statistical test on encrypted image generated from Proposed XOR and FBSC

Type of Test	Lena	Boat	Barb	Goldhill	Mandrill	Mountain	Washsat	Peppers
Frequency Test	0.4120	0.9606	0.6140	0.1815	0.1327	0.4770	0.0257	0.1384
Frequency Test within a Block	0.4227	0.9000	0.7167	0.7484	0.6990	0.5227	0.2836	0.8312
Run Test	0.7315	0.2578	0.1093	0.6254	0.8976	0.3402	0.5621	0.9247
Longest Run of Ones in a Block	0.6318	0.8852	0.4275	0.7094	0.9136	0.0158	0.7462	0.3985
Binary Matrix Rank Test	0.2036	0.5903	0.8315	0.1089	0.4462	0.7084	0.1975	0.5243
Discrete Fourier Transform (Spectral) Test	0.8319	0.7642	0.4198	0.6310	0.2894	0.5021	0.6193	0.8801
Non-Overlapping Template Matching Test	0.7432	0.1839	0.9136	0.2874	0.5726	0.4261	0.9583	0.7310
Overlapping Template Matching Test	0.8196	0.1753	0.6402	0.5049	0.7284	0.8319	0.4627	0.6951
Maurer’s Universal Statistical test	0.1742	0.6932	0.2783	0.5229	0.7401	0.6192	0.9240	0.4715
Linear Complexity Test	0.5903	0.8315	0.1089	0.4462	0.7084	0.1975	0.5243	0.9621
Serial Test 1	0.7683	0.4906	0.9157	0.2314	0.6728	0.9285	0.1396	0.8183
Serial Test 2	0.1794	0.7362	0.3049	0.9128	0.6523	0.4418	0.7195	0.5871
Approximate Entropy Test	0.5412	0.8629	0.1754	0.7083	0.4367	0.2984	0.8271	0.6315
Cumulative Sums (Forward)	0.4026	0.9531	0.6872	0.8194	0.3658	0.7841	0.5927	0.4103
Cumulative Sums (Reverse)	0.6472	0.2895	0.8102	0.5398	0.7321	0.1754	0.9832	0.6291

5.2.2 Histogram analysis

This section compares the encrypted and original image pixels using a histogram plot. Table 7 presents the original image pixels distributed non-uniformly throughout the region, while the encrypted image shows a uniform distribution of pixels in the histogram graph plot.

Table 7. Histogram analysis

Original Image	Pictorial Original Image	Pictorial Encrypted Image
image016.jpg	image017.png	image018.png
image019.jpg	image020.png	image021.png
image022.png	image023.png	image024.png
image025.jpg	image026.png	image027.png
image028.jpg	image023.png	image024.png
image029.jpg	image030.png	image031.png
image032.jpg	image033.png	image034.png
image035.jpg	image036.png	image037.png

5.2.3 Correlation coefficient (CF) analysis

The correlation coefficient analysis uses the mean and variance of pixels within the nearest pixel and is computed as Eq. (31).

$Corr\text{ }\!\!~\!\!\text{ }\left( X,Y \right)=\frac{\left| \frac{1}{N}\mathop{\sum }_{i=1}^{n}\left( {{X}_{i}}-E\left( X \right) \right)\left( {{Y}_{i}}-E\left( Y \right) \right) \right|}{\sqrt{\frac{1}{N}\text{ }\!\!~\!\!\text{ }\mathop{\sum }_{i=1}^{n}{{\left( {{X}_{i}}-E\left( X \right) \right)}^{2}}\times \text{ }\!\!~\!\!\text{ }{{\left( {{Y}_{i}}-E\left( Y \right) \right)}^{2}}\text{ }\!\!~\!\!\text{ }}}$                            (31)

Here, E(x) and E(y) are the mean of the pixel value, and it is computed as Eq. (32).

$E\left( X \right)=\frac{1}{N}\text{ }\!\!~\!\!\text{ }\underset{i=1}{\overset{n}{\mathop \sum }}\,{{X}_{i}}$ & $E\left( Y \right)=\frac{1}{N}\text{ }\!\!~\!\!\text{ }\underset{i=1}{\overset{n}{\mathop \sum }}\,{{Y}_{i}}$                      (32)

Table 8 summarizes the comparison results of correlation coefficient analysis for benchmark grayscale images of size (256×256). The test includes 16,384 pairs of neighboring pixels to perform the CF analysis. The correlation coefficient values for the original images are closer to ‘1’, indicating a higher degree of correlation between neighboring pixels. In contrast, the coefficient correlation values for the encrypted data are more relative to ‘0’, meaning a lower degree of correlation between neighboring pixels. The observation suggests that the proposed XOR and Involution Function-Based Stream Cipher generates high entropy among neighboring pixels.

Table 8. Comparing correlation values of different methods

Here, ciphered image values are nearer to ‘0’ for all the images. The proposed XOR and function-based stream cipher technique results indicate that the encryption process has successfully obscured the original image’s patterns.

5.2.4 Differential attack analysis

Differential Attack Analysis is a method used to test the robustness of cryptographic algorithms, particularly in how small changes in the input (such as altering a single pixel in an image) can affect the output (the encrypted image).

NPCR (Number of Pixels Change Rate) is a measure used in Differential Attack Analysis to evaluate the extent of pixel change across an encrypted image when a single pixel in the original image is altered.

$NPCR=\frac{\mathop{\sum }_{i=1}^{R}\mathop{\sum }_{j=1}^{c}{{E}_{d}}\left( i,j \right)}{R~\times C}$                            (33)

where, ‘R’ and ‘C’ are the images’ dimensions (rows and columns). $E_d(i, j)$ is a binary indicator function.

${{E}_{d}}\left( i,j \right)=\left\{ \begin{matrix}   0,~if~{{E}_{1}}\left( \text{i},\text{ }\!\!~\!\!\text{ j} \right)={{E}_{2}}\left( i,~j \right)~  \\   1,~if~{{E}_{1}}\left( \text{i},\text{ }\!\!~\!\!\text{ j} \right)\ne {{E}_{2}}\left( i,~j \right)  \\ \end{matrix} \right.~$                            (34)

where, E₁ is the encrypted image of the original image, and E₂ is the encrypted image of the original image with one pixel altered. A high NPCR value indicates that the encryption algorithm causes significant changes in the encrypted image when a single pixel in the original image is modified, demonstrating strong sensitivity and resistance to differential attacks. The ideal NPCR value is around 99.609%.

UACI (Unified Average Changing Intensity) measures the average intensity difference between two encrypted images, providing insight into how uniformly the encryption algorithm spreads the changes.

$UACI=\frac{\mathop{\sum }_{i=1}^{R}\mathop{\sum }_{j=1}^{c}\left| {{E}_{1}}\left( i,j \right)-{{E}_{2}}\left( i,j \right) \right|}{255\times ~R~\times C}$                       (35)

where, |E₁(i,j)-E₂(i,j)| is the absolute difference in pixel values at coordinate (i, j) between the two encrypted images, and 255 is the maximum possible pixel value for an 8-bit image. A high UACI value indicates that the encryption algorithm effectively distributes the changes across the image, ensuring that the differences in the input are diffused throughout the encrypted image. The ideal UACI value is around 33.46%.

Table 9. Comparison of average NPCR and UACI values

In Table 9, the NPCR and UACI values of the proposed algorithm are compared to those of other algorithms. The results demonstrate that the proposed algorithm surpasses the ideal NPCR and UACI benchmarks, indicating high resistance to differential attacks.

5.3 Security analysis

The section is divided into two parts: (i) Computational Overhead, (ii) Storage Overhead, and (iii) Security Analysis.

5.3.1 Computation overhead

The computational overhead evaluates the performance of proposed Attributed-based hierarchical tree structure scheme (AB-HTS-S). The performance of the scheme is related to decryption of the encrypted data using shared secret points.

Here the AB-HTS-S is compared with existing schemes such as CP-WABE-CA, CC-ABE, and CP-ABE-SD. Our scheme uses an Attributed-based hierarchical tree structure with Lagrange interpolation to enable efficient multi-user collaborative decryption. To our knowledge, no existing scheme supports hierarchical tree structure access. The parameter for evaluation is as follows:

• $ \delta$: exponential operations overhead.
• $\tau$: hash operations calculational effort.
• $ \rho$: calculational overhead for pairing operations within group H.
• $ v$: number of users cluster.
• $ v_a$: attributes connected to access tree.
• $ v_c$: connected node count.
• $ v_u$: number of attributes a user required for decryption.
• $ \nu_{c, r}$: number of non-leaf nodes required to regenerate root node.
• $ v_{l, c}$: count of non-leaf nodes required to compute leaf node.
• $ |\mathrm{H}|$  size of an element in group H.
• $\left|\mathrm{H}_{\mathrm{T}}\right|$ size of an element in the H_T group.

Table 10 present the comparison of computation overhead for each phase across different schemes establishes the proposed scheme’s efficiency and performance advantage by requiring fewer computational resources, making it well-suited for cryptographic operations.

Table 10. Comparison of computational overhead

The next experiment is performed to observe the number of attributes used to construct the polynomial using a multiparty authorization key. Figure 4 represents the reconstruction time of Skey_Points and performs the encryption and decryption using XOR and Functional-Based Stream Cipher (FBSC). The results indicate that as the number of attributes increases, the time required for encryption also increases. It implies a clear relationship between the complexity of the attribute set and the computational burden during the encryption process. Consequently, more attributes lead to longer encryption times, underscoring the influence of attribute count on encryption efficiency.

image038.png

Figure 4. Encryption time

Figure 5 presents the decryption cost on both the Organization_Server and Data User (DUs) sides. The cost of decryption increases linearly with an increase in the user attributes. The server-side costs encompass computational resources and time required to manage, process, and decrypt data, which increase as user attributes grow. The increases in server costs result from the heightened complexity and increased data handling associated with each additional attribute. Decryption costs also rise with the number of attributes on the DUs side. It encompasses the time and computational power needed for the user’s device to decrypt the data. As the number of attributes expands, the decryption process becomes more resource-intensive, leading to longer decryption times and higher energy consumption on the user’s device.

image039.png

Figure 5. Decryption time

5.3.2 Storage overhead

The experiment is performed to evaluate the impact of attribute size on the storage overhead of an Organization_Server. The owner and user points are required for key reconstruction in the proposed system. The size of each parameter in the scheme is represented by |P_i|, while ‘m’ and ‘m_j’ denote the total number of attributes for owners and users, respectively. Table 11 compares the storage overhead of different parameter sizes used for key generation.

m_AA=the number of elements in the management domain.

K_c=the number of elements rooted in the ciphertext.

Table 11. Comparison of storage overhead

Our proposed model stores authorization Skey_Points generated using a polynomial on the Organization_Server. At the same time, the DAC-MACS model [17] utilizes the secret authority component for key reconstruction. In contrast, our proposed scheme only requires the local Organization_Server to store the authorization points as tokens for key reconstruction. After sharing the encrypted data and Skey_Points, the PK_sk and $\text{Encryption}\_\text{Dat}{{\text{a}}_{\text{i}}}$ are deleted from the Organization_Server. The organization server manages all attributes, while the cloud solely stores an Access Control List (ACL) and $\text{Encryption}\_\text{Dat}{{\text{a}}_{\text{i}}}$.Our system holds fewer parameters compared to Yang’s DAC-MACS. When the owner’s attributes exceed the number of user identities, it increases storage overhead for data consumers and impacts ‘m_i’ with the same ‘mj’. By merging the same user identities, we can reduce storage overhead. Thus, in our scheme, a user’s storage overhead is not influenced by the number of user identities.

5.3.3 Security analysis

(1) Partial authorization key exposure attack

In our system, if an attacker possesses ‘j’ shares of the Skey_Points, it is equivalent to the adversary having no secret key share.

Proof: To reconstruct the PK_sk In our proposed system, we require a minimum of three shares (Organization_Server, D_Owner, and DUs points) to generate the polynomial. Let us assume that ‘P_i’ denote the probability of adversary guessing an available Skey_Points with ‘i’ shares. The authentication is performed based on the Organization_Server and D_Owner share, which means that an adversary cannot access the encrypted file unless the D_Owner doesn’t provide the authorization Skey_Points share to the system. It involves two requirements: (i) the set of attribute points must satisfy encryption, and (ii) the D_Owner must approve the access of the data file containing the attributes and share the key.

(2) Collusion attack resistance

Our system has been designed with a robust security feature to resist collusion attacks.

Proof: In our proposed model, each D_Owner is associated with attributes such as User_Id (U_i), User_Type (UT_i), and User_Credentials (UC_i). The UC_i is integrated into polynomials alongside $P{{K}_{sk}}$, which is utilized in Function-Based Stream Cipher. Organization_Server and D_Owner are required to access the encrypted file, ensuring that only one recipient can access the file at any time. The attribute integration is given as Eq 36.

$U{{C}_{i}}=f\left( P{{K}_{sk}},{{U}_{i}},U{{T}_{i}} \right)$                    (36)

Only the Organization_Server and D_Owner are authorized to access the encrypted file, ensuring it is given as Eq. 37.

 $Acces{{s}_{Requirements}}=\left( \text{Organizatio}{{\text{n}}_{\text{Server}}}+{{\text{D}}_{\text{Owner}}} \right)$                    (37)

The attachment of the D_Owner shares to generate PK_sk is prohibited, preventing unauthorized access as Eq 38.

$P{{K}_{sk}}=f\left( {{U}_{i}},U{{T}_{i}},U{{C}_{i}} \right)$                     (38)

If multiple DUs attempt to perform the task independently, the decryption of $\text{Encryption}\_\text{Dat}{{\text{a}}_{\text{i}}}$ cannot be jointly carried out simultaneously, as represented in Eq. (39).

$\text{Decryption}\_\text{Tas}{{\text{k}}_{\text{i}}}=~DU{{s}_{1}}+DU{{s}_{2}}+\ldots +DU{{s}_{n}}$                   (39)

(3) Security resilience against compromised owner points

Our system maintains security even when some owner points are compromised.

Proof: In previous studies on related schemes [17, 23], the scheme constraints stipulate that Organization_Server, D_Owner, and DUs points can collectively generate the symmetric secret key PK_sk. This mechanism assumes that if any points belonging to DUs are compromised, the adversary may utilize those points for key generation. The proposed system employs a two-way authentication process, where Organization_Server authenticates the adversary’s credentials. Once authentication is completed, the Organization_Server requires the D_Owner share to generate the symmetric secret key PK_sk. Subsequently, D_Owner validates the recipient using the access control list. With these properties in place, the construction of PK_sk using the proposed scheme remains resilient, even when some D_Owner points are compromised. The constraint on key generation is given as Eq. (40).

$P{{K}_{sk}}=f\left( \text{Organizatio}{{\text{n}}_{\text{Server}}}+{{\text{D}}_{\text{Owner}}}+DUs \right)$                      (40)

The OrganizationServer authenticates the adversary’s credentials using Eq. (41).

$Aut{{h}_{OS}}=g\left( Adversary\_Credentials \right)$                   (41)

Once authenticated, the Organization_Server requires the D_Owner share to generate the PK_sk:

$Aut{{h}_{DO}}=h\left( {{\text{D}}_{\text{Owner}}}\_Share \right)$                     (42)

The D_Owner validates the recipient using the access control list.

$Validation=i\left( Recipient,~\text{Access}\_Control\_List \right)$                    (43)

Even if some D_Owner points are compromised, the construction of PK_sk using the proposed scheme remains robust:

$Resilience=j\left( Compromised\_{{\text{D}}_{\text{Owner}}}\_Points \right)$                      (44)

The proposed scheme ensures the integrity of the PK_sk generation process.

(4) Chosen plaintext attack (CPA)

The chosen plaintext attack (CPA) is mitigated in our proposed scheme through a robust security model involving dual-layer authentication and an Attribute-based hierarchical tree structure scheme. When an adversary attempts to perform a CPA by selecting plaintexts and obtaining their corresponding ciphertexts, they cannot decrypt the ciphertexts without proper authentication. The encryption process uses the PK_sk, which is derived through a two-way authentication mechanism: the Organization_Server first authenticates credentials and then requires the D_Owner share for PK_sk. Even if some D_Owner points are compromised, the adversary cannot generate the PK_sk due to the need for both Organization_Server and D_Owner validation. It ensures that any decryption attempt by the adversary fails, as they cannot bypass the authentication process or obtain PK_sk. Thus, the attributed-based hierarchical tree structure with Lagrange interpolation in our scheme provides robust security against chosen plaintext attacks, maintaining the integrity and confidentiality of the encrypted data.